BaFin Sets New Deadlines for Remedying Deficiencies at Deutsche Bank AG
The Bundesanstalt für Finanzdienstleistungsaufsicht (BaFin, Federal Financial Supervisory Authority) has ordered new deadlines for Deutsche Bank AG to remedy deficiencies in the area of certain data processing systems. According to the BaFin publication of 9 October 2026, the measure was already issued on 15 September 2026. According to the authority, the administrative decision has been final since 6 October 2026.
The systems concerned are those used to monitor transactions. The purpose of this monitoring is to prevent money laundering and terrorist financing. The current order follows on from earlier supervisory measures from 2021 and 2023 and updates them in part.
Legal Basis of the Supervisory Order
Measure under the Geldwäschegesetz and the Kreditwesengesetz
BaFin bases the order on § 51 Absatz 2 Satz 1 des Gesetzes über das Aufspüren von Gewinnen aus schweren Straftaten, des Geldwäschegesetzes (GwG, German Anti-Money Laundering Act), in conjunction with § 25h Absatz 5 des Kreditwesengesetzes (KWG, German Banking Act). These provisions enable supervisory measures where requirements relating to the prevention of money laundering and terrorist financing are concerned.
Under the statutory requirements, credit institutions must use data processing systems capable of identifying suspicious business relationships and transactions in payment transactions. The relevant obligations arise in particular from:
- § 25h Absatz 1 bis 3 KWG,
- § 6 Absatz 2 Nummer 1 Buchstabe e GwG,
- § 10 Absatz 1 Nummer 5 GwG.
These systems are often referred to as transaction monitoring. They serve to identify conspicuous processes so that facts subject to reporting obligations can subsequently be transmitted to the Zentralstelle für Finanztransaktionsuntersuchungen, the Financial Intelligence Unit.
No Publication of Specific Deadline Dates
BaFin did not state any specific deadline dates in its notice. Nor does the published version provide details on which technical deficiencies specifically continue to exist or which sub-areas of the data processing systems are affected by the new deadlines.
According to the information available, the order does not include a fine. Rather, its subject matter is the updating of earlier orders by which BaFin had already required the prompt remediation of deficiencies in the bank’s transaction monitoring.
Background: Transaction Monitoring at Credit Institutions
Importance for the Prevention of Money Laundering and Terrorist Financing
Credit institutions are obliged to maintain organisational and technical arrangements in order to be able to identify suspicious business relationships and conspicuous payment flows. Transaction monitoring is an essential component of internal control and safeguarding systems in this context.
The monitoring of transactions is intended to make it possible to detect suspicious facts. If relevant transactions are identified, the statutory reporting obligations to the Financial Intelligence Unit may be triggered. A technical alert or a conspicuous transaction does not, in itself, mean that money laundering or terrorist financing has in fact occurred.
Ongoing Updating of Systems
For monitoring systems to work reliably, they must be updated continuously. This applies in particular to adaptation to changed technical requirements and supervisory requirements. In its notice, BaFin points out that the realignment of transaction monitoring at Deutsche Bank AG had, due to changed technical requirements, partly made new deadlines for remedying deficiencies necessary.
Earlier Measures by BaFin Against Deutsche Bank AG
Orders from April 2021 and November 2023
BaFin had already ordered Deutsche Bank AG in April 2021 and in November 2023 to promptly remedy deficiencies in transaction monitoring. The aim of these earlier measures was to achieve an improvement in the data processing systems.
The orders from 2021 and 2023 were intended to ensure that the bank, within specified deadlines, makes certain that the data processing systems it uses are functional in accordance with the statutory and supervisory requirements.
According to BaFin, the predecessor order of 21 November 2023 became final on 29 December 2023. It was accompanied by a threat of coercive fines in the event that the obligations were not fulfilled.
Special Commissioner to Monitor Implementation
In connection with earlier supervisory measures, BaFin had extended the mandate of a special commissioner already appointed by administrative decision of 21 September 2018 under § 45c Absatz 1 in conjunction with Absatz 2 Nummer 6 KWG to monitor implementation. This extension applied until 30 October 2024.
According to a report by Handelsblatt, the mandate of the special commissioner for money laundering was not extended at the end of 2024 because BaFin had seen progress by the bank. This information concerns the status of implementation monitoring at that time and does not alter the fact that the current order of 15 September 2026 updates earlier requirements in part.
Assessment of the Current Decision
Update Rather Than an Entirely New Package of Measures
According to BaFin’s notice, the current ruling is to be understood as an update to earlier orders. It does not replace the previous context with an entirely new package of measures, but sets new deadlines for remedying deficiencies insofar as the realignment of transaction monitoring made this necessary due to changed technical requirements.
Deutsche Bank stated with regard to the order that it had already made substantial progress in implementing the measures still outstanding in the area of transaction monitoring; the ruling contained neither new findings nor additional requirements. This presentation is to be classified as the bank’s statement; the published supervisory notice by BaFin remains decisive.
No Finding of the Bank’s Own Money Laundering Acts
The published BaFin notice contains no finding that Deutsche Bank AG itself engaged in money laundering or terrorist financing. The subject matter of the order is data processing systems that serve to identify suspicious business relationships and transactions.
To the extent that other proceedings or capital-market-related topics concerning Deutsche Bank AG are mentioned in parallel in reporting, these must be distinguished from the supervisory order addressed here. Reports included, among other things, a 1MDB proceeding involving a claim of 1.1 billion US dollars and a hearing scheduled for 26 October 2026. For such ongoing proceedings, allegations must not be treated as proven as long as there is no final determination.
Publication and Market Environment
Announcement on 9 October 2026
BaFin published the measure on Friday, 9 October 2026. In parallel, the authority also made an English-language version of the notice available. The publication took place after the administrative decision had been final since 6 October 2026.
Market reporting also noted that Deutsche Bank AG’s share closed at EUR 30.05 on 9 October 2026. In addition, reports covered the completion of a share buyback with a volume of EUR 500 million. This information concerns the capital market environment and stands alongside BaFin’s supervisory measure.
Comparable Orders Also Against Other Institutions
Supervisory measures relating to transaction monitoring do not exclusively concern Deutsche Bank AG. BaFin has also taken comparable orders against other institutions, for example against Société Générale S.A. Niederlassung Frankfurt by administrative decision of 18 January 2024, which has been final since 19 February 2024.
This shows that the monitoring of payment flows to prevent money laundering and terrorist financing is an ongoing focus of banking supervisory activity. For institutions, the functionality of the data processing systems used and their continuous adaptation are decisive.
Legal Significance for Companies and Affected Parties
Supervisory Requirements for Technical Control Systems
The order illustrates the close connection between anti-money laundering prevention, banking supervisory obligations and technical control systems. For regulated institutions, it is not solely decisive that control processes are provided for organisationally. They must also be supported by functional data processing systems that comply with the statutory and supervisory requirements.
It remains decisive that, in the published text, BaFin only communicates the ordering of new deadlines for remedying deficiencies. The notice does not contain the publication of specific technical details or individual deadline dates.
Advice on Supervisory Law Issues
Supervisory orders in connection with anti-money laundering prevention, technical control systems and official measures can have considerable legal and organisational significance for companies. MTR Legal Rechtsanwälte advises companies, investors and high-net-worth private individuals on issues at the interface of regulation, banking supervision and public commercial law. Anyone requiring a legal assessment of comparable official measures can find further information under Legal advice in public law.
